Between 1 September and 7 October 2026, three cloud offers announced a SecNumCloud qualification from ANSSI, the French cybersecurity agency: Numspot’s IaaS, OVHcloud’s SNC Cloud Platform, and Orange Business’s Cloud Avenue SecNum Dynamic. SecNumCloud qualifies an offer, for a limited time. The word “sovereign”, or “trusted cloud”, does not qualify anything by itself. ANSSI said so publicly in January 2026, after the qualification of S3NS’s hybrid offer.
Three offers, three perimeters
On 1 September 2026, Numspot announced the qualification of its IaaS offer. The PaaS track is still in progress. The provider says this IaaS also carries HDS certification, for health data, and ISO 27001. The same day, OVHcloud announced the qualification of SNC Cloud Platform, presented as its third qualified offer, after Bare Metal Pod and VMware on OVHcloud. Two announcements on one day do not make one family of offers.
On 7 October 2026, Orange Business announced the qualification of Cloud Avenue SecNum Dynamic. It complements Cloud Avenue SecNum, qualified in July 2025. The newer offer uses resources dedicated to the customer, physically isolated, and can run active/active between the Val-de-Reuil and Chartres sites. It includes dedicated GPU servers for inference and training. The 2025 offer can combine SecNumCloud, ISO 27001, and HDS on the same environment. None of this qualifies the group as a whole. It qualifies the named offer, within the scope on the catalog.
What the 12 August order makes mandatory
The order of 12 August 2026 approves version 3.2 of the SecNumCloud framework. That version, dated 8 March 2022, adds protection against non-European laws, including the US CLOUD Act. The order makes the framework binding for certain cloud services used by the French state, its operators, and public-interest groups when they process data of particular sensitivity. A qualification lasts three years. It comes with an annual surveillance audit. A substantial change to the offer must be declared to ANSSI.
Two consequences follow for anyone reading a tender. The public ANSSI catalog is the only list that counts: an offer “in the qualification process” is not qualified. In autumn 2026, Bleu, the Capgemini and Orange joint venture, said it was aiming for a qualification by year-end and had not obtained one. And when data of different sensitivity shares one infrastructure, commentary on the text published this autumn stresses that real technical isolation is what keeps the requirement from spreading to the whole stack. A motivated exemption exists when no qualified offer covers the need. It does not turn ordinary hosting into qualified hosting.
The label does not choose the architecture
For a business system or an agent, the useful questions are still those in Data sovereignty: operational criteria. Where does the data rest. Which subprocessors see the content, including the model provider. Can a full dataset be exported. Can the team operate the choice over time. A SecNumCloud qualification answers part of this, for the covered offer. It does not log an agent’s actions, and it does not name who owns a write.
The reverse is also true. An instance installed on the customer’s side, as with OCTOWISE for building energy, settles location without claiming a qualification the product does not display. The same care applies when evaluating an AI vendor: read the contracted scope, not the brochure. The catalog grew in September and October 2026. It is read offer by offer.
